CVE-2019-11202
Description
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may choose to delete this default admin user. If Rancher is restarted, the default admin user will be recreated with the well-known default password. An attacker could exploit this by logging in with the default admin credentials. This can be mitigated by deactivating the default admin user rather than completing deleting them.
How to fix
- github.com/rancher/rancher2.2.2, 2.2.2+incompatible or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| suse rancher | 2.0.0 ≤ v ≤ 2.0.13, 2.1.0 ≤ v ≤ 2.1.8, 2.2.0 ≤ v ≤ 2.2.1 | — |
| github.com/rancher/rancherGo | 2.0.0 ≤ v ≤ 2.0.13, 2.1.0 ≤ v ≤ 2.1.8, 2.2.0 ≤ v < 2.2.2, 2.0.0+incompatible ≤ v < 2.2.2+incompatible | 2.2.2, 2.2.2+incompatible |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.